Internet monitor finds loopholes in social security system across China

Tens of millions of residents in China registered in the country's social security system face a risk of personal information leak over system loopholes, a domestic Internet security monitoring platform warned on Wednesday.

The platform, butian.360.cn of IT company Qihu 360, found that over 50 million items of residents' information including ID numbers, salaries and properties might be leaked.

Information on the government management system including household registration, disease control and prevention centers and hospitals in over 30 provincial regions and cities also face a risk.

A total of 2.7 million items of residents' information might be leaked due to a system loophole in the social security bureau of Cangzhou, Hebei Province, while a loophole in Shaanxi Province's Department of Human Resources and Social Security risks leaking at least 2.1 million items of information of rural residents.

"We paid great attention to this warning and have reported it to authorities for further investigation," an employee at the publicity office of the Shaanxi social security department told the Global Times Wednesday.

The platform's media officer surnamed Yin told the Global Times that they have submitted detailed information to relevant authorities.

"Loopholes currently found are only the tip of the iceberg and more people could be at risk beyond our imagination," Deng Huan, a security expert from the platform, told the Global Times.

Deng said that sensitive information stored in the social security system, once leaked, would not only invade one's privacy but also be used by unscrupulous people.

"For example, some may illegally copy ID cards and use credit cards with other people's identities."

He also pointed out that the possible massive leak threatens the national economy as personal income and social security benefits information would be revealed.

Loopholes are common in the Internet era, but it should serve as a reminder to local governments to fix the loopholes as quickly as possible rather than bragging about detecting the loopholes, Qin An, a cyber security expert, told the Global Times.

"The massive loopholes reflect the problems in Chinese authorities' management and supervision of cyber information security," Qin said. "Meanwhile, the Internet security service provider should not exaggerate the potential threats of such loopholes but make efforts to solve the problem."

Fang Xingdong, director of the Center for Internet and Society of the Zhejiang University of Media and Communications, called for the establishment of an accountability mechanism in information leakage since some government bodies were found to sell public information.

A revised draft of China's new national security law, which is undergoing second reading, has proposed the establishment of systems for cyber and information security and national cyber sovereignty.